codex-workflow-v2 2.0.0-beta.12 → 2.0.0-beta.12.1

package/README.md

@@ -43,7 +43,7 @@ cross-machine synchronization are not part of its contract.
 Node.js 22 or newer is required. Consumers pin the exact package version:
 
 ```bash
-npm install --save-dev --save-exact codex-workflow-v2@2.0.0-beta.12
+npm install --save-dev --save-exact codex-workflow-v2@2.0.0-beta.12.1
 npx codex-workflow gateway handshake --repo .
 npx codex-workflow doctor --repo .
 ```
@@ -302,9 +302,10 @@ alpha regressions that must not recur are tracked in the
 - [Chat-only development guide](docs/pdf/codex-workflow-v2-chat-only-guide-ru.pdf)
 - [Deep technical reference](docs/pdf/codex-workflow-v2-technical-reference-ru.pdf)
 
-These beta.12 documents cover delegated Discovery, Milestone Autonomy Contract issuance,
+These beta.12.1 documents cover delegated Discovery, Milestone Autonomy Contract issuance,
 dependency-aware Task routing, C1 credential handling, external-sealed reviews, bounded
-Plan-integrity recovery, and the P04-A structural-replacement stop boundary. Their reviewable
+Plan-integrity recovery, Task-local dependency provenance recovery, the human-confirmed legacy
+attempt-four stop override, and the P04-A structural-replacement stop boundary. Their reviewable
 sources live in [`docs/pdf/sources`](docs/pdf/sources), and `npm run docs:pdf:check` proves the
 tracked binaries were generated from the current source and package version. The PDFs remain
 human-facing artifacts; the Markdown documents above, bundled gateway, schemas, and runtime code

package/dist/src/alpha6/remediation.d.ts

@@ -1,10 +1,11 @@
-import type { CorrectiveDecisionEvent, CorrectiveDecisionRecoveryEvent, CorrectivePlanAuditInput, GuardedRiskCategory, PlanIntegrityConflictEvidence, RemediationEvent, RemediationFailureEvidence, RemediationFailureKind, RemediationMode, RemediationModeRecoveryEvent, TaskState } from '../contracts.js';
+import type { CorrectiveDecisionEvent, CorrectiveDecisionRecoveryEvent, CorrectivePlanAuditInput, GuardedRiskCategory, PlanIntegrityConflictEvidence, RemediationEvent, RemediationFailureEvidence, RemediationFailureKind, RemediationMode, RemediationModeRecoveryEvent, StopEscalateOverrideEvent, StopEscalateOverridePreparation, TaskState } from '../contracts.js';
 import type { FileStateStore } from '../state/store.js';
 import type { CurrentPlanRiskAudit } from './plan-risk.js';
 export declare const REMEDIATION_EVENTS_SIDECAR = "remediation-events.jsonl";
 export declare const CORRECTIVE_DECISIONS_SIDECAR = "corrective-decisions.jsonl";
 export declare const CORRECTIVE_DECISION_RECOVERIES_SIDECAR = "corrective-decision-recoveries.jsonl";
 export declare const REMEDIATION_MODE_RECOVERIES_SIDECAR = "remediation-mode-recoveries.jsonl";
+export declare const STOP_ESCALATE_OVERRIDES_SIDECAR = "stop-escalate-overrides.jsonl";
 export interface GuardedRemediationAttemptGate {
     stepId: string;
     guardedCategory: GuardedRiskCategory;
@@ -30,11 +31,15 @@ export declare function readCorrectiveDecisionEvents(store: FileStateStore, task
 export declare function defaultCorrectiveAuditorActor(taskId: string): string;
 export declare function assertCorrectiveAuditorIndependence(store: FileStateStore, task: TaskState, stepId: string, auditor: string): void;
 export declare function readRemediationModeRecoveryEvents(store: FileStateStore, task: TaskState): RemediationModeRecoveryEvent[];
+export declare function readStopEscalateOverrideEvents(store: FileStateStore, task: TaskState): StopEscalateOverrideEvent[];
+export declare function stopEscalateOverrideDecisionEventIds(store: FileStateStore, task: TaskState): ReadonlySet<string>;
 export declare function appendRemediationEvent(store: FileStateStore, task: TaskState, stepId: string, failureKind: RemediationFailureKind, failureEvidence: RemediationFailureEvidence, planRiskAudit: CurrentPlanRiskAudit, now: Date): RemediationEvent;
 export declare function findRemediationModeRecoveryCandidate(store: FileStateStore, task: TaskState): RemediationModeRecoveryAssessment | null;
 export declare function assessRemediationModeRecovery(store: FileStateStore, task: TaskState, stepId: string, actor: string, writerToken: string | null): RemediationModeRecoveryAssessment;
 export declare function appendRemediationModeRecovery(store: FileStateStore, task: TaskState, stepId: string, expectedRevision: number, actor: string, writerToken: string | null, now: Date): RemediationModeRecoveryEvent;
 export declare function appendCorrectiveDecisionEvent(store: FileStateStore, task: TaskState, stepId: string, correctiveAudit: CorrectivePlanAuditInput, planRiskAudit: CurrentPlanRiskAudit, planHash: string, now: Date): CorrectiveDecisionEvent;
+export declare function prepareStopEscalateOverride(store: FileStateStore, task: TaskState, stepId: string, expectedRevision: number, actor: string, reason: string, headCommit: string): StopEscalateOverridePreparation;
+export declare function appendStopEscalateOverride(store: FileStateStore, task: TaskState, stepId: string, expectedRevision: number, actor: string, reason: string, headCommit: string, confirmationCode: string, now: Date): StopEscalateOverrideEvent;
 export declare function appendPlanIntegrityRecoveryDecision(store: FileStateStore, task: TaskState, stepId: string, auditor: string, evidence: PlanIntegrityConflictEvidence, now: Date): CorrectiveDecisionEvent;
 export declare function assertGuardedRemediationAttemptAllowed(store: FileStateStore, task: TaskState, stepId: string, planRiskAudit: CurrentPlanRiskAudit, recoveredDecisionEventId?: string | null): GuardedRemediationAttemptGate;
 export declare function readGuardedRemediationPostureForStep(store: FileStateStore, task: TaskState, stepId: string, planRiskAudit: CurrentPlanRiskAudit): GuardedRemediationAttemptGate | null;

package/dist/src/alpha6/remediation.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { WorkflowError } from '../errors.js';
 import { hashCanonical } from '../lifecycle/fingerprint.js';
 import { createUlid } from '../ulid.js';
+import { PACKAGE_VERSION } from '../version.js';
 import { assertHash64, canonicalJsonStringify, sha256Hex } from './store-sidecars.js';
 import { readTaskC1Posture } from './handoff.js';
 import { buildCurrentStrictStepReviewCycle, latestPassedVerifiedStepReviewEvent, readReviewerAttestations, readStepReviewEvents, } from './review.js';
@@ -10,7 +11,10 @@ export const REMEDIATION_EVENTS_SIDECAR = 'remediation-events.jsonl';
 export const CORRECTIVE_DECISIONS_SIDECAR = 'corrective-decisions.jsonl';
 export const CORRECTIVE_DECISION_RECOVERIES_SIDECAR = 'corrective-decision-recoveries.jsonl';
 export const REMEDIATION_MODE_RECOVERIES_SIDECAR = 'remediation-mode-recoveries.jsonl';
+export const STOP_ESCALATE_OVERRIDES_SIDECAR = 'stop-escalate-overrides.jsonl';
 const REMEDIATION_MODE_RECOVERY_LOCK = '.remediation-mode-recovery.lock';
+const STOP_ESCALATE_OVERRIDE_LOCK = '.stop-escalate-override.lock';
+const LEGACY_STOP_OVERRIDE_POLICY = 'beta11-attempt4-stop-compatibility-v1';
 const COMMIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
 const REMEDIATION_FAILURE_KINDS = new Set([
     'checks-failed',
@@ -71,11 +75,12 @@ function validateRemediationHistory(store, task) {
     const remediationEvents = readRawRemediationEvents(store, task);
     const correctiveDecisionEvents = readRawCorrectiveDecisionEvents(store, task);
     const modeRecoveries = readRemediationModeRecoveryEvents(store, task);
+    const overriddenStopDecisionEventIds = validateStopEscalateOverrideHistory(task, remediationEvents, correctiveDecisionEvents, readRawStopEscalateOverrideEvents(store, task));
     validateRemediationAttemptOrdinals(remediationEvents, task);
     validateRemediationReviewReferences(store, task, remediationEvents);
     validateCorrectiveDecisionCoverage(task, correctiveDecisionEvents, remediationEvents);
     const recoveredEventIds = validateRemediationModeRecoveries(store, task, remediationEvents, correctiveDecisionEvents, modeRecoveries);
-    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents, recoveredEventIds);
+    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents, recoveredEventIds, overriddenStopDecisionEventIds);
     return {
         remediationEvents,
         correctiveDecisionEvents,
@@ -115,6 +120,32 @@ function readRawCorrectiveDecisionEvents(store, task) {
         validateEvent: (event, context) => validateStoredCorrectiveDecisionEvent(event, task, context.file, context.line),
     });
 }
+function readRawStopEscalateOverrideEvents(store, task) {
+    const root = store.taskRoot(task.projectId, task.id);
+    const sidecarFile = path.join(root, STOP_ESCALATE_OVERRIDES_SIDECAR);
+    if (!existsSync(sidecarFile))
+        return [];
+    return store.readSidecarEvents(root, STOP_ESCALATE_OVERRIDES_SIDECAR, {
+        validateEvent: (event, context) => validateStoredStopEscalateOverride(event, task, context.file, context.line),
+    });
+}
+export function readStopEscalateOverrideEvents(store, task) {
+    const remediations = readRawRemediationEvents(store, task);
+    const decisions = readRawCorrectiveDecisionEvents(store, task);
+    const overrides = readRawStopEscalateOverrideEvents(store, task);
+    validateRemediationAttemptOrdinals(remediations, task);
+    validateCorrectiveDecisionCoverage(task, decisions, remediations);
+    validateStopEscalateOverrideHistory(task, remediations, decisions, overrides);
+    return overrides;
+}
+export function stopEscalateOverrideDecisionEventIds(store, task) {
+    const remediations = readRawRemediationEvents(store, task);
+    const decisions = readRawCorrectiveDecisionEvents(store, task);
+    const overrides = readRawStopEscalateOverrideEvents(store, task);
+    validateRemediationAttemptOrdinals(remediations, task);
+    validateCorrectiveDecisionCoverage(task, decisions, remediations);
+    return validateStopEscalateOverrideHistory(task, remediations, decisions, overrides);
+}
 export function appendRemediationEvent(store, task, stepId, failureKind, failureEvidence, planRiskAudit, now) {
     const recoveredDecisionEventId = findCorrectiveRecoveryDecisionIdForFailure(store, task, stepId);
     const existing = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
@@ -132,6 +163,7 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
         const priorEvents = existing.filter((event) => event.attemptOrdinal < reused.attemptOrdinal);
         const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, priorEvents, readCorrectiveDecisionEvents(store, task), {
             recoveredDecisionEventId,
+            overriddenStopDecisionEventIds: stopEscalateOverrideDecisionEventIds(store, task),
         });
         if (reused.attemptOrdinal !== gate.nextAttemptOrdinal || reused.mode !== gate.mode || reused.guardedCategory !== gate.guardedCategory) {
             throw new WorkflowError('STATE_CORRUPT', 'Existing remediation event conflicts with the current guarded retry binding.', {
@@ -148,6 +180,7 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
     }
     const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, existing, readCorrectiveDecisionEvents(store, task), {
         recoveredDecisionEventId,
+        overriddenStopDecisionEventIds: stopEscalateOverrideDecisionEventIds(store, task),
     });
     return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR, {
         eventId: `RME-${createUlid(now.getTime())}`,
@@ -513,6 +546,176 @@ export function appendCorrectiveDecisionEvent(store, task, stepId, correctiveAud
         validateEvent: (event, context) => validateStoredCorrectiveDecisionEvent(event, task, context.file, context.line),
     });
 }
+export function prepareStopEscalateOverride(store, task, stepId, expectedRevision, actor, reason, headCommit) {
+    if (task.revision !== expectedRevision) {
+        throw new WorkflowError('STATE_CONFLICT', `State revision conflict for ${task.id}`, {
+            expectedRevision,
+            actualRevision: task.revision,
+        });
+    }
+    const normalizedActor = actor.trim();
+    const normalizedReason = reason.trim();
+    if (!normalizedActor)
+        throw new WorkflowError('INVALID_ARGUMENT', 'Stop override requires a human actor.');
+    if (!normalizedReason)
+        throw new WorkflowError('INVALID_ARGUMENT', 'Stop override requires a reason.');
+    if (!COMMIT_SHA_PATTERN.test(headCommit)) {
+        throw new WorkflowError('INVALID_ARGUMENT', 'Stop override requires the exact current Git HEAD.');
+    }
+    if (task.status !== 'needs_fix') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override requires a needs_fix Task.', {
+            taskId: task.id,
+            taskStatus: task.status,
+        });
+    }
+    const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+    if (!step)
+        throw new WorkflowError('NOT_FOUND', `Step not found: ${stepId}`);
+    if (step.status !== 'failed') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override requires the exact failed Step.', {
+            taskId: task.id,
+            stepId,
+            stepStatus: step.status,
+        });
+    }
+    if (!task.planHash)
+        throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} is missing its Plan hash.`);
+    const history = readOpenGuardedRemediationHistory(store, task, stepId);
+    const remediations = history.remediationEvents;
+    if (remediations.length !== 3
+        || remediations[0]?.attemptOrdinal !== 1
+        || remediations[0]?.mode !== 'ordinary'
+        || remediations[1]?.attemptOrdinal !== 2
+        || remediations[1]?.mode !== 'ordinary'
+        || remediations[2]?.attemptOrdinal !== 3
+        || remediations[2]?.mode !== 'corrective') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override is limited to the exact beta.11 three-failure history.', {
+            taskId: task.id,
+            stepId,
+            attempts: remediations.map((event) => ({ eventId: event.eventId, ordinal: event.attemptOrdinal, mode: event.mode })),
+        });
+    }
+    const priorContinueMatches = history.correctiveDecisions.filter((event) => event.triggeringAttemptCount === 3
+        && event.decision === 'continue-fix'
+        && event.planHash === task.planHash
+        && sameStringArray(event.coveredEventIds, remediations.slice(0, 2).map((candidate) => candidate.eventId)));
+    const stopMatches = history.correctiveDecisions.filter((event) => event.triggeringAttemptCount === 4
+        && event.decision === 'stop-escalate'
+        && event.planHash === task.planHash
+        && sameStringArray(event.coveredEventIds, remediations.map((candidate) => candidate.eventId)));
+    if (priorContinueMatches.length !== 1 || stopMatches.length !== 1) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override requires one exact attempt-3 continue decision and one exact attempt-4 stop decision.', {
+            taskId: task.id,
+            stepId,
+            priorContinueDecisionEventIds: priorContinueMatches.map((event) => event.eventId),
+            stopDecisionEventIds: stopMatches.map((event) => event.eventId),
+        });
+    }
+    const priorContinue = priorContinueMatches[0];
+    const stopDecision = stopMatches[0];
+    const binding = {
+        taskId: task.id,
+        taskRevision: task.revision,
+        stepId,
+        stopDecisionEventId: stopDecision.eventId,
+        stopDecisionEventHash: stopDecision.eventHash,
+        priorContinueDecisionEventId: priorContinue.eventId,
+        priorContinueDecisionEventHash: priorContinue.eventHash,
+        triggeringAttemptCount: 4,
+        coveredEventIds: remediations.map((event) => event.eventId),
+        planHash: task.planHash,
+        headCommit,
+        actor: normalizedActor,
+        reason: normalizedReason,
+        packageVersion: PACKAGE_VERSION,
+        policy: LEGACY_STOP_OVERRIDE_POLICY,
+    };
+    const confirmationCodeBindingHash = stopEscalateOverrideBindingHash(binding);
+    const existing = readStopEscalateOverrideEvents(store, task).find((event) => event.stopDecisionEventId === stopDecision.eventId) ?? null;
+    if (existing && existing.confirmationCodeBindingHash !== confirmationCodeBindingHash) {
+        throw new WorkflowError('STATE_CONFLICT', 'The stop decision already has an override with a different human binding.', {
+            taskId: task.id,
+            stepId,
+            overrideEventId: existing.eventId,
+        });
+    }
+    return {
+        eligible: true,
+        action: 'task stop-override-apply',
+        ...binding,
+        confirmationCodeBindingHash,
+        confirmationCode: `SOO-${confirmationCodeBindingHash.slice(0, 24).toUpperCase()}`,
+        appendOnly: true,
+        preservesOriginalDecision: true,
+        delegatedApprovalAllowed: false,
+    };
+}
+export function appendStopEscalateOverride(store, task, stepId, expectedRevision, actor, reason, headCommit, confirmationCode, now) {
+    const prepared = prepareStopEscalateOverride(store, task, stepId, expectedRevision, actor, reason, headCommit);
+    if (confirmationCode.trim() !== prepared.confirmationCode) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override confirmation code does not match the current state binding.', {
+            taskId: task.id,
+            stepId,
+            confirmationCodeBindingHash: prepared.confirmationCodeBindingHash,
+        });
+    }
+    const root = store.taskRoot(task.projectId, task.id);
+    const existing = readStopEscalateOverrideEvents(store, task).find((event) => event.stopDecisionEventId === prepared.stopDecisionEventId) ?? null;
+    if (existing)
+        return existing;
+    const lockFile = path.join(root, STOP_ESCALATE_OVERRIDE_LOCK);
+    let descriptor;
+    try {
+        descriptor = openSync(lockFile, 'wx', 0o600);
+        closeSync(descriptor);
+    }
+    catch (error) {
+        if (existsSync(lockFile)) {
+            throw new WorkflowError('LOCKED', `Stop override for ${task.id} is already being serialized.`, {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        throw error;
+    }
+    try {
+        const currentTask = store.readTask(task.projectId, task.id);
+        const underLock = prepareStopEscalateOverride(store, currentTask, stepId, expectedRevision, actor, reason, headCommit);
+        if (underLock.confirmationCode !== prepared.confirmationCode
+            || underLock.confirmationCodeBindingHash !== prepared.confirmationCodeBindingHash) {
+            throw new WorkflowError('STATE_CONFLICT', 'Stop override evidence changed after preparation.', {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        return store.appendSidecarEvent(root, STOP_ESCALATE_OVERRIDES_SIDECAR, {
+            eventId: `SOO-${createUlid(now.getTime())}`,
+            recordedAt: now.toISOString(),
+            taskId: underLock.taskId,
+            taskRevision: underLock.taskRevision,
+            stepId: underLock.stepId,
+            stopDecisionEventId: underLock.stopDecisionEventId,
+            stopDecisionEventHash: underLock.stopDecisionEventHash,
+            priorContinueDecisionEventId: underLock.priorContinueDecisionEventId,
+            priorContinueDecisionEventHash: underLock.priorContinueDecisionEventHash,
+            triggeringAttemptCount: 4,
+            coveredEventIds: underLock.coveredEventIds,
+            planHash: underLock.planHash,
+            headCommit: underLock.headCommit,
+            actor: underLock.actor,
+            reason: underLock.reason,
+            packageVersion: underLock.packageVersion,
+            confirmationCodeBindingHash: underLock.confirmationCodeBindingHash,
+            policy: LEGACY_STOP_OVERRIDE_POLICY,
+        }, {
+            validateEvent: (event, context) => validateStoredStopEscalateOverride(event, currentTask, context.file, context.line),
+        });
+    }
+    finally {
+        if (existsSync(lockFile))
+            unlinkSync(lockFile);
+    }
+}
 export function appendPlanIntegrityRecoveryDecision(store, task, stepId, auditor, evidence, now) {
     if (!task.planHash) {
         throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} has no Plan hash for Plan-integrity recovery.`);
@@ -577,6 +780,7 @@ export function assertGuardedRemediationAttemptAllowed(store, task, stepId, plan
     return deriveAttemptGateFromHistory(task, stepId, planRiskAudit, history.remediationEvents, history.correctiveDecisions, {
         enforceRuntimeGate: true,
         recoveredDecisionEventId,
+        overriddenStopDecisionEventIds: stopEscalateOverrideDecisionEventIds(store, task),
     });
 }
 export function readGuardedRemediationPostureForStep(store, task, stepId, planRiskAudit) {
@@ -597,14 +801,18 @@ export function readGuardedRemediationPostureForStep(store, task, stepId, planRi
     if (remediationEvents.length < 2 && earlyPlanIntegrityDecision?.recoveryBasis !== 'plan-integrity')
         return null;
     if (step.status === 'failed' || step.status === 'planned') {
-        return deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEvents, history.correctiveDecisions);
+        return deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEvents, history.correctiveDecisions, {
+            overriddenStopDecisionEventIds: stopEscalateOverrideDecisionEventIds(store, task),
+        });
     }
     if (task.status !== 'blocked' || step.status !== 'in_progress' || !step.evidence)
         return null;
     const currentCycle = buildCurrentStrictStepReviewCycle(store, task, stepId);
     if (currentCycle.resolution !== 'unverified')
         return null;
-    return deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEvents, history.correctiveDecisions);
+    return deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEvents, history.correctiveDecisions, {
+        overriddenStopDecisionEventIds: stopEscalateOverrideDecisionEventIds(store, task),
+    });
 }
 function readOpenGuardedRemediationHistory(store, task, stepId) {
     const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
@@ -725,6 +933,18 @@ function deriveAttemptGateFromHistory(task, stepId, planRiskAudit, remediationEv
             posture: 'decision-required',
         };
     }
+    if (correctiveDecision.decision === 'stop-escalate'
+        && options.overriddenStopDecisionEventIds?.has(correctiveDecision.eventId)) {
+        return {
+            stepId,
+            guardedCategory,
+            attemptCount,
+            nextAttemptOrdinal,
+            mode: 'corrective',
+            correctiveDecision,
+            posture: 'continue-fix',
+        };
+    }
     if (correctiveDecision.decision !== 'continue-fix' && options.enforceRuntimeGate) {
         throw correctiveDecisionBlockedError(task, stepId, attemptCount, correctiveDecision);
     }
@@ -916,6 +1136,133 @@ function validateStoredCorrectiveDecisionEvent(event, task, file, line) {
         });
     }
 }
+function validateStoredStopEscalateOverride(event, task, file, line) {
+    if (!/^SOO-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.eventId)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Stop override eventId is malformed.', { file, line });
+    }
+    if (event.taskId !== task.id
+        || !Number.isInteger(event.taskRevision)
+        || event.taskRevision < 1
+        || event.taskRevision > task.revision
+        || typeof event.stepId !== 'string'
+        || !event.stepId.trim()
+        || event.triggeringAttemptCount !== 4
+        || event.policy !== LEGACY_STOP_OVERRIDE_POLICY) {
+        throw new WorkflowError('STATE_CORRUPT', 'Stop override does not match its Task or compatibility policy.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+        });
+    }
+    if (!/^CRD-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.stopDecisionEventId)
+        || !/^CRD-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.priorContinueDecisionEventId)
+        || !COMMIT_SHA_PATTERN.test(event.headCommit)
+        || typeof event.actor !== 'string'
+        || !event.actor.trim()
+        || typeof event.reason !== 'string'
+        || !event.reason.trim()
+        || typeof event.packageVersion !== 'string'
+        || !event.packageVersion.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Stop override identifiers or human evidence are malformed.', {
+            file,
+            line,
+            taskId: task.id,
+        });
+    }
+    const coveredEventIds = normalizeStringList(event.coveredEventIds, 'Stop override coveredEventIds');
+    if (coveredEventIds.length !== 3 || new Set(coveredEventIds).size !== coveredEventIds.length) {
+        throw new WorkflowError('STATE_CORRUPT', 'Stop override must bind exactly three distinct remediation events.', {
+            file,
+            line,
+            taskId: task.id,
+            stepId: event.stepId,
+        });
+    }
+    for (const [label, value] of [
+        ['stopDecisionEventHash', event.stopDecisionEventHash],
+        ['priorContinueDecisionEventHash', event.priorContinueDecisionEventHash],
+        ['planHash', event.planHash],
+        ['confirmationCodeBindingHash', event.confirmationCodeBindingHash],
+    ]) {
+        assertHash64(value, `Stop override ${label} at ${file}:${line}`);
+    }
+    const expectedBindingHash = stopEscalateOverrideBindingHash(event);
+    if (event.confirmationCodeBindingHash !== expectedBindingHash) {
+        throw new WorkflowError('STATE_CORRUPT', 'Stop override confirmation binding hash is invalid.', {
+            file,
+            line,
+            taskId: task.id,
+            expectedBindingHash,
+            actualBindingHash: event.confirmationCodeBindingHash,
+        });
+    }
+}
+function validateStopEscalateOverrideHistory(task, remediations, decisions, overrides) {
+    const overriddenDecisionIds = new Set();
+    for (const override of overrides) {
+        if (overriddenDecisionIds.has(override.stopDecisionEventId)) {
+            throw new WorkflowError('STATE_CORRUPT', 'Multiple stop overrides target one corrective decision.', {
+                taskId: task.id,
+                stepId: override.stepId,
+                stopDecisionEventId: override.stopDecisionEventId,
+            });
+        }
+        const stepRemediations = remediations
+            .filter((event) => event.stepId === override.stepId && event.attemptOrdinal <= 3)
+            .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
+        const stopDecision = decisions.find((event) => event.eventId === override.stopDecisionEventId) ?? null;
+        const priorContinue = decisions.find((event) => event.eventId === override.priorContinueDecisionEventId) ?? null;
+        if (stepRemediations.length !== 3
+            || stepRemediations[0]?.attemptOrdinal !== 1
+            || stepRemediations[0]?.mode !== 'ordinary'
+            || stepRemediations[1]?.attemptOrdinal !== 2
+            || stepRemediations[1]?.mode !== 'ordinary'
+            || stepRemediations[2]?.attemptOrdinal !== 3
+            || stepRemediations[2]?.mode !== 'corrective'
+            || !stopDecision
+            || stopDecision.eventHash !== override.stopDecisionEventHash
+            || stopDecision.decision !== 'stop-escalate'
+            || stopDecision.triggeringAttemptCount !== 4
+            || stopDecision.planHash !== override.planHash
+            || !priorContinue
+            || priorContinue.eventHash !== override.priorContinueDecisionEventHash
+            || priorContinue.decision !== 'continue-fix'
+            || priorContinue.triggeringAttemptCount !== 3
+            || priorContinue.planHash !== override.planHash
+            || !sameStringArray(override.coveredEventIds, stepRemediations.map((event) => event.eventId))
+            || !sameStringArray(stopDecision.coveredEventIds, override.coveredEventIds)
+            || !sameStringArray(priorContinue.coveredEventIds, override.coveredEventIds.slice(0, 2))) {
+            throw new WorkflowError('STATE_CORRUPT', 'Stop override does not bind the exact beta.11 attempt-4 stop history.', {
+                taskId: task.id,
+                stepId: override.stepId,
+                overrideEventId: override.eventId,
+            });
+        }
+        overriddenDecisionIds.add(override.stopDecisionEventId);
+    }
+    return overriddenDecisionIds;
+}
+function stopEscalateOverrideBindingHash(input) {
+    return hashCanonical({
+        domain: 'codex-workflow/stop-escalate-override/v1',
+        taskId: input.taskId,
+        taskRevision: input.taskRevision,
+        stepId: input.stepId,
+        stopDecisionEventId: input.stopDecisionEventId,
+        stopDecisionEventHash: input.stopDecisionEventHash,
+        priorContinueDecisionEventId: input.priorContinueDecisionEventId,
+        priorContinueDecisionEventHash: input.priorContinueDecisionEventHash,
+        triggeringAttemptCount: input.triggeringAttemptCount,
+        coveredEventIds: [...input.coveredEventIds],
+        planHash: input.planHash,
+        headCommit: input.headCommit,
+        actor: input.actor,
+        reason: input.reason,
+        packageVersion: input.packageVersion,
+        policy: input.policy,
+    });
+}
 function validatePlanIntegrityDecision(event, task, file, line) {
     const evidence = event.planIntegrityEvidence;
     if (event.recoveryBasis !== 'plan-integrity'
@@ -1286,7 +1633,7 @@ function validateCorrectiveDecisionCoverage(task, decisions, remediationEvents)
         }
     }
 }
-function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions, recoveredEventIds) {
+function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions, recoveredEventIds, overriddenStopDecisionEventIds) {
     for (const event of remediationEvents) {
         if (event.attemptOrdinal <= 2) {
             if (event.mode !== 'ordinary') {
@@ -1314,7 +1661,9 @@ function validateHistoricalRemediationModes(task, stepId, remediationEvents, cor
         const matching = correctiveDecisions.filter((decision) => decision.taskId === task.id
             && decision.stepId === stepId
             && decision.triggeringAttemptCount === event.attemptOrdinal
-            && (decision.decision === 'continue-fix' || decision.decision === 'replan-required')
+            && (decision.decision === 'continue-fix'
+                || decision.decision === 'replan-required'
+                || (decision.decision === 'stop-escalate' && overriddenStopDecisionEventIds.has(decision.eventId)))
             && sameStringArray(decision.coveredEventIds, priorEvents.map((candidate) => candidate.eventId)));
         if (matching.length > 1) {
             throw new WorkflowError('STATE_CORRUPT', 'Corrective remediation mode has conflicting decisions for the exact attempt ordinal.', {
@@ -1327,13 +1676,13 @@ function validateHistoricalRemediationModes(task, stepId, remediationEvents, cor
         }
     }
 }
-function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions, recoveredEventIds) {
+function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions, recoveredEventIds, overriddenStopDecisionEventIds) {
     const stepIds = new Set(remediationEvents.map((event) => event.stepId));
     for (const stepId of stepIds) {
         const stepEvents = remediationEvents
             .filter((event) => event.stepId === stepId)
             .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
-        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions, recoveredEventIds);
+        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions, recoveredEventIds, overriddenStopDecisionEventIds);
     }
 }
 function validateCorrectiveDecisionAudit(audit) {